How to delete Win32.Worm.Bobax.A/C?

[CAROLG]

I have bought a new Accer laptop; it was working fine until I have start using Internet. The internet was working fine for more than three days and after that my Acer laptop got hanged; whenever I try to do something it gets hanged. Then I scanned Accer laptop with the online virus scan and displayed me a message that Win32.Worm.Bobax.A/C found”. I have no idea from where virus came from, in to my Accer laptop. Can anybody help me with this problem? I am waiting for any related reply.

[Milton.J]

Win32.Worm.Bobax.A/C which is found on your laptop is worm which makes the working of system slow by using its memory space. Win32.Worm.Bobax.A/C gets on multiplying until it hangs your system. The speed of spreading this worm is very high but the damage it causes is very low. I will suggest you to download any removal tool and get rid of this worm.

[Spyrus]

If your laptop is suffering from the worm named as “Win32.Worm.Bobax.A/C” then you can find the following entry in your registry window
HKLM \Software\Microsoft\Windows\CurrentVersion\Run and RunServices.
To stop this worm in your system I will suggest you to remove this virus entry from your system. For opening registry window goto start>run>type “regedit” and then press enter

[Snake08]

I was also suffering with Win32.Worm.Bobax.A/C worm problem so I have searched for the information related to this worm, may be this information will help you in dealing with this worm. This worm comes as an exe. The main functionality is contained in the dynamic link library. So you have to delete those DLL’s from your system. I have downloaded avast antivirus and got rid of this problem so I will suggest you the same.

[Zachary]

WORM_BOBAX.A is a worm that acts as a proxy to allow a remote attacker to access an infected system. The worm spreads by exploiting the Microsoft LSASS buffer overflow vulnerability reported in Microsoft bulletin MS04-011 and IntelliShield Alert 7535.
When executed, a .dll file is created in the \%Temp% folder. This file contains the trojan component. When the .dll file is run, the worm copies itself as a random file name to the \%System% folder and modifies the registry to ensure it runs each time Windows starts. The worm then creates a mutex as 00:24:03:54A9D to ensure only one instance exits and registers itself as a service to hide from the Windows Task Manager.
WORM_BOBAX.A scans random IP addresses for a connection. If successful, a copy of the worm is downloaded to a target system by sending a packet over TCP port 445. The packet allows the remote system to connect to a HTTP server and obtain a worm copy as svc.exe. The svc.exe file is then saved and executed on the newly infected system.
The worm opens ports at random and listens for remote connections. The ports act as a SMTP server to allow an attacker to e-mail the infected system as a mail server.

[Shen]

For removing Win32.Worm.Bobax.A/C from your system start your windows in safe mode and delete this registry HKLM \Software\Microsoft\Windows\CurrentVersion\Run and RunServices. After that scan the system to make sure that the worm is removed from your system.